Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
85,682cataloged exploits
39,953CVEs with public exploitation
24,696lab-tested
AllReferência 25,887Exploit-DB 24,488GitHub PoC 17,378VulnCheck XDB 9,888Nuclei 4,513Metasploit 3,528✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
CoolPlayer Portable 2.19.1 - '.m3u' Local Buffer Overflow (2)
Stack-based buffer overflow in PortableApps CoolPlayer Portable (aka CoolPlayer+ Portable) 2.19.6 and earlier allows rem
28RISK
open ↗Referência✓ VexDay Proof
Easy Scripts Answer and Question Script - Multiple Vulnerabilities
myaccount.php in Easy Scripts Answer and Question Script allows remote attackers to remove arbitrary user accounts via a
23RISK
open ↗Referência✓ VexDay Proof
AV Tutorial Script 1.0 - Remote User Pass Change
changePW.php in AV Tutorial Script (avtutorial) 1.0 does not require authentication or knowledge of an old password for
23RISK
open ↗Referência✓ VexDay Proof
AuraCMS 1.62 - 'stat.php' Remote Code Execution
stat.php in AuraCMS 1.62, and Mod Block Statistik for AuraCMS, allows remote attackers to inject arbitrary PHP code into
23RISK
open ↗Referência✓ VexDay Proof
Adobe Reader - 'util.printf()' JavaScript Function Stack Overflow (1)
Stack-based buffer overflow in Adobe Acrobat and Reader 8.1.2 and earlier allows remote attackers to execute arbitrary c
100RISK
open ↗Referência✓ VexDay Proof
A-shop 0.70 - Remote File Deletion
Directory traversal vulnerability in admin/filebrowser.asp in A-shop 0.70 and earlier, and possibly 0.71, allows remote
23RISK
open ↗Referência✓ VexDay Proof
Uebimiau Web-Mail 2.7.10/2.7.2 - Remote File Disclosure
Directory traversal vulnerability in error.php in Uebimiau Webmail 2.7.10 and 2.7.2 allows remote authenticated users to
23RISK
open ↗Referência✓ VexDay Proof
phpBB Module XS-Mod 2.3.1 - Local File Inclusion
Directory traversal vulnerability in admin/admin_xs.php in eXtreme Styles module (XS-Mod) 2.3.1 and 2.4.0 for phpBB allo
23RISK
open ↗Referência✓ VexDay Proof
Aprox CMS Engine 5.1.0.4 - Local File Inclusion
Directory traversal vulnerability in index.php in AproxEngine 5.1.0.4 allows remote attackers to include and execute arb
23RISK
open ↗Referência✓ VexDay Proof
PHP weather 2.2.2 - Local File Inclusion / Cross-Site Scripting
Directory traversal vulnerability in test.php in PHP Weather 2.2.2 allows remote attackers to include and execute arbitr
23RISK
open ↗Referência✓ VexDay Proof
phpAddEdit 1.3 - 'editform' Local File Inclusion
Directory traversal vulnerability in addedit-render.php in phpAddEdit 1.3, when magic_quotes_gpc is disabled, allows rem
23RISK
open ↗Referência✓ VexDay Proof
Telephone Directory 2008 - Arbitrary Delete Contact
del_query1.php in Telephone Directory 2008 allows remote attackers to delete arbitrary contacts via a direct request wit
23RISK
open ↗Referência✓ VexDay Proof
LaVague 0.3 - 'printbar.php?views_path' Remote File Inclusion
PHP remote file inclusion vulnerability in views/print/printbar.php in LaVague 0.3 and earlier allows remote attackers t
45RISK
open ↗Referência✓ VexDay Proof
Gelato - 'index.php?post' SQL Injection
SQL injection vulnerability in classes/gelato.class.php in Gelato allows remote attackers to execute arbitrary SQL comma
23RISK
open ↗Referência✓ VexDay Proof
TurnkeyForms Local Classifieds - Cross-Site Scripting / SQL Injection
Cross-site scripting (XSS) vulnerability in listtest.php in TurnkeyForms Local Classifieds allows remote attackers to in
23RISK
open ↗Referência✓ VexDay Proof
SMA-DB 0.3.13 - Multiple Remote File Inclusions
Multiple PHP remote file inclusion vulnerabilities in theme/format.php in SMA-DB 0.3.13 allow remote attackers to execut
23RISK
open ↗Referência✓ VexDay Proof
Harpia CMS 1.0.5 - Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Harpia CMS 1.0.5 and earlier allow remote attackers to execute arb
23RISK
open ↗Referência✓ VexDay Proof
Thyme Calendar 1.3 - SQL Injection
SQL injection vulnerability in event_view.php in Thyme Calendar 1.3 allows remote attackers to execute arbitrary SQL com
23RISK
open ↗Referência✓ VexDay Proof
PHP-Nuke platinum 7.6.b.5 - Remote File Inclusion
PHP remote file inclusion vulnerability in modules/Forums/favorites.php in PHP-Nuke Platinum 7.6.b.5 allows remote attac
23RISK
open ↗Referência✓ VexDay Proof
PEEL CMS 3.x - Admin Hash Extraction / Arbitrary File Upload
PEEL, possibly 3.x and earlier, has (1) a default info@peel.fr account with password admin, and (2) a default contact@pe
23RISK
open ↗Referência✓ VexDay Proof
KubeLance 1.6.4 - 'ipn.php' Local File Inclusion
Directory traversal vulnerability in ipn.php in KubeLabs Kubelance 1.6.4 allows remote attackers to include and execute
23RISK
open ↗Referência✓ VexDay Proof
phpinv 0.8.0 - Local File Inclusion / Cross-Site Scripting
Directory traversal vulnerability in entry.php in phpInv 0.8.0 allows remote attackers to include and execute arbitrary
23RISK
open ↗Referência✓ VexDay Proof
FireAnt 1.3 - 'index.php' Local File Inclusion
Directory traversal vulnerability in index.php in FireAnt 1.3 allows remote attackers to include and execute arbitrary l
23RISK
open ↗Referência✓ VexDay Proof
LanSuite 3.3.2 - 'design' Local File Inclusion
Directory traversal vulnerability in index.php in LanSuite 3.3.2 allows remote attackers to include and execute arbitrar
23RISK
open ↗Referência✓ VexDay Proof
Globsy 1.0 - Remote File Rewriting
globsy_edit.php in Globsy 1.0 and earlier allows remote attackers to create or overwrite arbitrary files via a filename
23RISK
open ↗Referência✓ VexDay Proof
The Net Guys ASPired2Protect - Database Disclosure
The Net Guys ASPired2Protect stores sensitive information under the web root with insufficient access control, which all
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component live chat - SQL Injection / Open Proxy
Live Chat (com_livechat) component 1.0 for Joomla! allows remote attackers to use the xmlhttp.php script as an open HTTP
23RISK
open ↗Referência✓ VexDay Proof
PAD Site Scripts 3.6 - Arbitrary Database Backup
PAD Site Scripts 3.6 stores sensitive information under the web document root with insufficient access control, which al
23RISK
open ↗Referência✓ VexDay Proof
VT-Auth 1.0 - 'zHk8dEes3.txt' File Disclosure
Vlad Titarenko ASP VT Auth 1.0 stores sensitive information under the web root with insufficient access control, which a
23RISK
open ↗Referência✓ VexDay Proof
XZero Community Classifieds 4.95.11 - Remote File Inclusion
PHP remote file inclusion vulnerability in config.inc.php in XZero Community Classifieds 4.95.11 and earlier allows remo
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.